setup_requires breaks pip with Python 3.5 on macOS

[pquentin]

I'd like to mention that using setup_requires breaks pip with Python 3.5 on macOS because setup_requires dependencies are installed by easy_install, which uses the system OpenSSL, which only supports TLS 1.1 on macOS + Python 3.5. But PyPI only allows TLS 1.2.

See https://github.com/urllib3/urllib3/pull/1587#issuecomment-491692837 for more details if you're interested. I don't think this requires an action on your part, but I thought it would be useful to record this here.

[ionelmc]

Hmmm ... does anyone actually use 3.5 on osx?

[pquentin]

I guess it's mostly used by people who run Python 3.5 in production on eg. Debian but develop locally on macOS. So that's not a lot of people!

[scddev]

This also breaks with newer python, in my case python 3.7.1 on Solaris.

    ERROR: Complete output from command python setup.py egg_info:
    ERROR: Download error on https://pypi.org/simple/setuptools_scm/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:841) -- Some packages may not be found!
    Download error on https://pypi.org/simple/setuptools-scm/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:841) -- Some packages may not be found!
    Couldn't find index page for 'setuptools_scm' (maybe misspelled?)
    Download error on https://pypi.org/simple/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:841) -- Some packages may not be found!
    No local packages or working download links found for setuptools_scm>=3.3.1

Maybe also to note, I am running a pypi cache and basically pip is using that cache (/etc/pip.conf), but easy_install bypasses it and tries to connect directly.

Workaround for me is installing the dependency using pip upfront:

python3 -m pip install --upgrade setuptools-scm

[ionelmc]

Would using pyproject.toml help? Latest pip would handle the setuptools-scm dep then. https://www.python.org/dev/peps/pep-0518/

[ionelmc]

@scddev try the master, you shouldn't need that workaround.

[pquentin]

Ah, that's a great idea! It's a bit hard for me to test without a release on PyPI though. Maybe @scddev will be able to do it.

[scddev]

Worked for me:

-bash-3.2$ python3 -m venv .venv
-bash-3.2$ source .venv/bin/activate
(.venv) -bash-3.2$ python3 -m pip install --upgrade pip
Looking in indexes: https://xxx/artifactory/api/pypi/pypi-org/simple
Collecting pip
  Using cached https://xxx/artifactory/api/pypi/pypi-org/packages/5c/e0/be401c003291b56efc55aeba6a80ab790d3d4cece2778288d65323009420/pip-19.1.1-py2.py3-none-any.whl
Installing collected packages: pip
  Found existing installation: pip 10.0.1
    Uninstalling pip-10.0.1:
      Successfully uninstalled pip-10.0.1
Successfully installed pip-19.1.1
(.venv) -bash-3.2$ cd python-lazy-object-proxy/
(.venv) -bash-3.2$ python3 -m pip install -e .         
Looking in indexes: https://xxx/artifactory/api/pypi/pypi-org/simple
Obtaining file:///tmp/scd/python-lazy-object-proxy
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
    Preparing wheel metadata ... done
Installing collected packages: lazy-object-proxy
  Running setup.py develop for lazy-object-proxy
Successfully installed lazy-object-proxy
(.venv) -bash-3.2$ uname -a
SunOS yyy 5.10 Generic_Virtual sun4v sparc sun4v
(.venv) -bash-3.2$ python -V
Python 3.7.1